Why your US customers ask for a SOC 2 report
In the United States, SOC 2 is the standard buyers expect from software vendors. A US buyer asks for it before trusting you with their data. Without a report, the conversation often stops at procurement.
Three situations come up again and again:
- Your first large US customer. Their security team requires a SOC 2 report before signing. Your sales cycle depends on it.
- The security questionnaire. Hundreds of questions, customer after customer. A SOC 2 report answers most of them in one document.
- Fundraising or expansion. US investors and partners check your security maturity. A report from an independent auditor settles the question.
The hidden benefit: your team stops justifying its security case by case. They get back to selling and shipping.
A US deal on the line?
Find out what you need in 30 minutesSOC 2 explained: what the framework really requires
SOC 2 stands for System and Organization Controls 2. It is a framework defined by the AICPA, the American professional association of certified public accountants. It assesses how you protect your customers' data.
People often say "SOC 2 certification". The term is wrong. SOC 2 results in an attestation report: a qualified audit firm gives its opinion on your security controls. Nobody issues you a certificate.
The report is based on the Trust Services Criteria, the framework's five trust criteria:
- Security: required. Protection against unauthorized access.
- Availability: your service runs as promised to your customers.
- Confidentiality: sensitive information stays protected.
- Processing integrity: data is processed completely and accurately.
- Privacy: personal data is collected and used properly.
You pick the optional criteria based on what your customers expect. Most startups start with Security, sometimes adding Availability and Confidentiality.
There are two report types:
- Type 1: the auditor checks that your controls are well designed, at a given date.
- Type 2: the auditor checks that they worked over an observation period of several months.
What SOC 2 is not:
- Not a certification. It is an auditor's opinion, over a period or at a date.
- Not a fixed list of controls. You define your controls, and the auditor judges whether they cover the criteria.
- Not a public document. You share it with your customers, often under a nondisclosure agreement.
- Not a legal requirement. It is a commercial requirement from your customers.
How long does a SOC 2 report take?
Three phases follow each other:
- Preparation is the work. Scope, write, deploy controls, collect evidence. This is where time is won or lost.
- The observation period, for Type 2. Your controls must run for a chosen period. In the market, it often lasts 3 to 12 months.
- The SOC 2 audit is the validation. The firm tests your controls, then writes and issues the report. ouwba gets you ready, and only the firm signs the report.
Why so many projects slip:
- Too many criteria chosen from the start.
- Evidence collected by hand, in spreadsheets, at the last minute.
- A Type 2 started before the controls really run. The gaps show up in the report.
- Nobody has dedicated time. The project always comes after the product.
SOC 2, ISO 27001, HDS, NIS 2: which one do you need?
It all depends on your customers and your data.
- Your customers are in the US: SOC 2 is the expected standard.
- You sell in Europe, to large enterprises or the public sector: the reference is ISO 27001, a certification issued by an accredited body. See our ISO 27001 certification support.
- You host health data on behalf of others: HDS certification (health data hosting) is mandatory in France. See our HDS certification support.
- You operate in a regulated sector: the European NIS 2 directive (security of network and information systems) may apply to you. See our NIS 2 compliance support.
Selling on both sides of the Atlantic? SOC 2 and ISO 27001 requirements overlap: the work done for one carries over to the other.
Torn between SOC 2 and ISO 27001?
Ask an expertYour questions about the SOC 2 report
What is a SOC 2 report?
It is a report written by an independent audit firm about your security controls. It follows the SOC 2 (System and Organization Controls 2) framework defined by the AICPA, the American professional association of certified public accountants. It describes your system, lists your controls and gives the auditor's opinion. Your customers, especially in the US, use it to check that you protect their data properly.
Is SOC 2 a certification?
No. People often say "SOC 2 certification", but the term is wrong. SOC 2 results in an attestation report: a qualified firm gives its opinion on how your controls are designed and how they operate. There is no certificate and no official logo to display on your site. ISO 27001, by contrast, results in a real certificate issued by an accredited body.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 checks that your controls are well designed, at a given date. Type 2 checks that they actually worked over an observation period, often 3 to 12 months in the market. Type 2 carries more weight with buyers. Many startups start with a Type 1 to unlock a contract, then move on to a Type 2.
How long does it take to get a SOC 2 report?
Most of the time goes into preparation. With ouwba, it takes a few weeks, depending on scope and your team's availability. For a Type 2, add the observation period, chosen with the audit firm. Then come the auditor's tests and the writing of the report. A Type 1 is therefore faster to obtain.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is a US framework. It results in an attestation report written by an audit firm, expected mostly in the United States. ISO 27001 is an international standard. It results in a certificate issued by an accredited body, expected mostly in Europe. Both cover similar requirements. If you sell on both sides of the Atlantic, the work done for one serves the other.
Do you need a US audit firm?
It does not have to be based in the United States. The firm must, however, be qualified to issue reports under AICPA standards, which means practicing as a CPA firm (licensed US certified public accountants). Some have teams in Europe. Check this qualification before signing: your customers will not accept a report issued by an unqualified firm.
Which Trust Services Criteria should you choose?
The Security criterion is required and already covers most expectations. The other four are optional: Availability, Confidentiality, Processing integrity and Privacy. Pick them based on what your customers expect and on your business. Each added criterion widens the audit, and so the workload and the cost. Most startups start with Security, sometimes adding Availability and Confidentiality.
How long does a SOC 2 report stay valid?
A SOC 2 report has no official expiry date. In practice, your customers expect a recent report that covers the last months of your activity. Most companies therefore renew their audit every year. Compliance becomes a rhythm, not a one-off project. Evidence collected automatically makes the following years' audits much easier.
Where do you start?
Start by framing your need. Which customer requires the report? By when? Type 1 or Type 2? Which criteria? The ouwba assessment answers these questions in 30 minutes with an expert. You leave with a recommended scope, your priorities and a first estimate of the timeline, with no preparation on your side. If your deadline is tight, you will also know whether it is realistic.